국토부 부동산 실거래가

MOLIT apartment real transaction price API

The skill implements the claimed MOLIT API calls, but it contains a clear inconsistency: SKILL.md tells users to save their API key at ~/.config/data-go-kr/api_key while the script reads /home/scott/.config/data-go-kr/api_key. Before installing or using this skill: 1) Inspect and edit scripts/real_estate.sh to remove the hardcoded '/home/scott' path (use $HOME or the documented ~/.config path, or better accept an env var). 2) Require the skill metadata to declare the config path or env variable for the API key so the agent can surface that requirement. 3) Consider storing the key with correct permissions and avoid putting secrets into logs; note the script sends the key as a URL parameter (common for this API) which can show up in server logs—if concerned, prefer POST or server-side proxying. 4) Test the script in a sandbox with your key and confirm it only queries apis.data.go.kr and prints results. If you are not comfortable editing the script to remove the hardcoded path, do not install the skill.

Type: OpenClaw Skill Name: molit-real-estate Version: 2.2.0 The skill is classified as suspicious due to a critical shell injection vulnerability in `scripts/real_estate.sh`. The script directly interpolates user-controlled arguments (`$1`, `$2`, `$3`) into a `python3 -c "..."` command without proper escaping. This allows an attacker, via prompt injection against the OpenClaw agent, to execute arbitrary shell commands on the host system, leading to Remote Code Execution (RCE). Additionally, the script hardcodes the API key path to `/home/scott/.config/data-go-kr/api_key`, which is a bug that may prevent the skill from functioning correctly for other users.